Web3 Security8 min read
Signing without a transaction: the messages that empty wallets
A signature request that costs no gas and never appears in your history can still hand over every token you hold. Permit, Permit2 and eth_sign explained without the hex.